CVE-2026-103436: Low severity Apcupsd Apcupsd vulnerability
apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%s %s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.
Affected Software
Event History
Frequently Asked Questions
Which versions and components are affected?
Apcupsd through version 3.14.14 is affected. The issue is in the CGI code used by upsstats.cgi, multimon.cgi, and upsfstats.cgi.
What does an attacker need to exploit this issue?
The vulnerability is network-reachable and does not require privileges or user interaction. Exploitation has high attack complexity.
How can I determine whether a system is vulnerable to this specific code path?
The affected path occurs when getupsvar() processes a matched STATUS line with fewer than three whitespace-separated tokens on the single-field path. In that case, the CGI caller can return uninitialized buffer contents in its HTTP response.